Vyxel Apps: one Android store for fourteen app sources

One catalog out of fourteen app sources

The pitch is scale through aggregation. Vyxel Apps scans fourteen sources: GitHub, GitLab, Codeberg, F-Droid, IzzyOnDroid, Aptoide, Aurora OSS, APKPure, Flathub, and WinGet, plus four root-module repositories, and merges everything into a single feed. On top of that sit 17 curated categories such as Games, Productivity, Security, Dev Tools, Media, and Finance, along with Trending and Newly Launched sections. Screenshots are pulled automatically from each repository README, an app comparison mode puts two candidates side by side, and the interface ships in 16 languages including English, Hindi, Spanish, French, German, Japanese, Portuguese, Italian, Russian, Chinese, Korean, Arabic, Dutch, Turkish, Polish, and Swedish. The README describes the result as zero ads and zero bloat, and the store logic is all Kotlin with a minimum SDK of API 26.

The signature check that guards the aggregation

Pulling installable packages from fourteen places multiplies the supply-chain surface, and the project answers that with one specific control: every downloaded APK is checked against the signing certificate of the app already installed on the phone before an install proceeds. The README states the consequence directly, that a hijacked repository or a redirected release cannot silently overwrite what is on your device. The README pairs this with an official-source notice: the only official source for Vyxel Apps is its own repository, and APKs from any other website or Telegram channel are unofficial and may be tampered with, so verify signatures. This is the honest architecture for an aggregator. The convenience comes from many repos, and the risk comes from many repos, so the defense has to sit at install time on the device, which is where they put it.

Updating and rolling back without the store fatigue

Installed apps are monitored in the background by WorkManager, which compares what is on the phone against the tracked sources and posts a notification when an update exists. The README contains a small inconsistency here worth knowing: the feature list counts fourteen sources, while the update-monitoring bullet says it checks against all six. Either way the monitoring is periodic rather than push-based. A home screen widget shows an App of the Day plus your pending update count, refreshed every 30 minutes. Install history is recorded, and rollback is a first-class action: you can go back to a previous version straight from the history, which matters when an update breaks something and the upstream repository has not reissued the old tag. Your GitHub starred repositories can sync into the favourites list, so the store reflects what you already track as a developer.

Getting the APK and the source

The README points every download at one place: the Releases page at github.com/NikhilKain/vyxel-apps/releases/latest, where the current tagged builds sit at v1.0.9 through v1.1.1, and the repository was last pushed on 2026-09-12. There is no Play Store listing documented, which fits a store-of-stores that would compete with its own distribution channel. Developers who want the open-core source are told to grab the Source code archive attached to any release or clone the main branch. The project is written in Kotlin throughout and declares a minimum SDK of API 26, so recent-ish Android versions are the target. The README also repeats its warning at the install stage: anything downloaded outside the official repository is unofficial and may be tampered with, so the signature check is the thing to trust, not the file name.

Silent installs and the root-modules screen

Two features target the rooted and power-user crowd explicitly. First, silent installs through Shizuku: when Shizuku is running on the device, Vyxel Apps skips the system install confirmation screen entirely, turning an update cycle of several taps per app into one background pass. Second, the Modules screen treats root-module repositories as first-class sources; the four root-module repos in the source list feed Magisk, Zygisk, LSPosed, and KernelSU modules alongside ordinary apps. Both choices are consistent with the open-source positioning, and both are also the features a cautious user should think about before using, since silent installs remove the exact confirmation step that catches a mistaken or malicious install. The signature check still runs on downloads, but the confirmation prompt is a separate layer of defense, and this setting removes it.

Trust Score and what it actually measures

Every listing carries a Trust Score from 0 to 100, computed from four signals the README names: stars, activity, releases, and forks. It is a popularity and maintenance heuristic, not a security verdict, and the distinction matters in a store that aggregates fourteen places. A freshly published gem from a known developer will score low; an abandoned app with an old star base will score comfortably. The README does not document the exact weighting, so treat the number as a ranking hint for sorting a crowded result list. For an actual safety decision, the project offers better instruments: the signature comparison at install time, the official-source notice, and the comparison mode that puts two candidate apps side by side with their extracted screenshots and metadata.

Open core: what AGPL-3.0 covers and what it does not

The license situation is deliberately split, and the repository metadata marks the overall project as NOASSERTION because of it. Everything that makes Vyxel Apps a store is open source under AGPL-3.0: all fourteen sources and the search, ranking, and merge engine, downloads, signature verification, Shizuku installs, update scanning, rollback, and install history, the Modules screen, both interfaces called Classic and Expressive, the Trust Score, comparison, backup and restore, and the 16 languages. The paid build adds only the four Liquid Glass Pro themes, Liquid Glass Dark, Liquid Glass Light, Neon Punk, and Cyberpunk, built on real-time backdrop blur and activated with a single license key, plus the license verification and entitlement service that guards them. The README is explicit about the boundary: no feature that affects finding, installing, updating, or removing an app is behind the paywall, and the paid cosmetics are what fund the rest. AGPL-3.0 also means any fork offered as a network service has to share its source.

How it compares with F-Droid

F-Droid is both a source inside Vyxel Apps and its most instructive alternative, because the two stores disagree on philosophy. F-Droid serves one curated repository and builds the apps it ships from source on its own infrastructure, which gives you strong provenance and slow updates, since every release waits for the F-Droid build cycle. Vyxel Apps aggregates the release feeds that developers publish themselves, so versions arrive as the upstream author ships them, including projects that will never qualify for F-Droid inclusion. The cost is that you are trusting more parties, which is exactly why the install-time signature comparison exists here and not in the F-Droid client. If your apps all live in F-Droid already, Vyxel Apps adds little. If half your apps come from GitHub releases and you are tired of checking ten repos by hand, that is the gap this fills.

Editorial conclusion

Vyxel Apps fits Android users who install software straight from developer repositories and want one place to search, update, and roll those installs back. Skip it if F-Droid alone already covers you, since aggregation is the whole point. After your first download, confirm the signature verification step ran, and treat the Trust Score as a sorting hint rather than a security verdict.

Frequently asked questions

Official sources

1. Issues
2. NikhilKain/vyxel-apps on GitHub
3. README
4. Releases